Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
Affected Versions: Version 2.2.2 and all versions below
Vulnerability Type: Insufficient Verification of Data Authenticity, Cross Site Scripting
Solution: An updated version 2.2.4 is available from the TYPO3 extension manager and at typo3.org/extensions/repository/view/sr_sendcard/2.2.4/. Users of the extension are advised to update the extension as soon as possible.
Credits: Credits go to Sebastian Fischer who discovered the issues. Furthermore the TYPO3 Security Team wishes to thank the extension author Stanislas Rolland for fixing the issues.